- About Mr_IT_Guy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Mr_IT_Guy
A model citizen
Member since Aug 8, 2017
7 hours ago
Community Record
244
Posts
470
Kudos
7
Solutions
Badges
2 weeks ago
Good morning @Vincent , First question I have to ask, under Security & SD-WAN>Configure>Site-to-site VPN, you should see a list of your local networks attacked to the MX64. On your Client VPN, do you have YES selected under the Use VPN column?
... View more
a month ago
2 Kudos
My company moved from WatchGuard XTM 820 to MX600. What would you like to know?
... View more
03-07-2019
02:33 PM
20 Kudos
A bit about yourself & your work I've been in networking for going on 7 years now. Currently I help design and maintain the network infrastructure for my company, as well as take on special projects to help improve our business. Your experience with Cisco Meraki I've been using Cisco Meraki for roughly four years all together. I introduced Meraki to my former company and another tech helped bring in Meraki in my current employer A fun fact about yourself I'm the proud owner of @Maui_Meraki_Dog
... View more
03-06-2019
01:41 PM
1 Kudo
I typically use 1812 as that's the default, but if you used 1645 you would want to match that in the Meraki. As for the vLAN, vLAN 4 would be correct.
... View more
03-05-2019
06:45 AM
3 Kudos
This is a great step towards the more in-depth training that many of us have been asking for! Hopefully the ECMS2 comes to my area soon as I don't think the company will fly me out to Meraki HQ as much as I would love to go!
... View more
03-01-2019
06:16 AM
That is correct.
... View more
02-28-2019
05:35 PM
3 Kudos
Correct, you use AD logins even if using RADIUS. RADIUS is used ALONG WITH AD. AD will be where it looks for the users you assign to the policy, but RADIUS is the one that enforces it. Think of it like this: RADIUS is the bouncer outside the VIP room of a club. It has to look at the exclusive list (AD) to see who gets in and who doesn't (i.e. your policy). Just because you can get into the club (i.e you have AD credentials) doesn't mean you can get into the VIP room (you don't match the policy) As for the Meraki IP you put as the RADIUS client, you would use the private IP. Keep in mind that if you have to go through a VPN tunnel to reach the RADIUS server, your MX IP would be the gateway of your HIGHEST numbered vLAN participating in site-to-site. For example, i f you have vLAN setup: vLAN 10 - gateway 192.168.10.1 vLAN 17 - gateway 192.168.17.1 vLAN 20 - gateway 192.168.20.1 vLAN 35 - gateway 192.168.35.1 vLAN 52 - gateway 192.168.52.1 and all vLANs are participating in site-to-site, the MX IP would be 192.168.52.1 as that is the highest numbered vLAN. IF vLANs 35 and 52 were NOT participating in site-to-site, then the MX IP would be 192.168.20.1 as vLAN 20 is the highest numbered vLAN.
... View more
02-28-2019
11:36 AM
3 Kudos
Hi @tantony , With AD authentication, you will point to one of your DCs for authentication purposes. As long as there is an AD account, the user will be able to connect to the VPN. (Active Directory Integration) With RADIUS, you will point to a RADIUS server for authentication, which allows you to provide a bit more security. You can setup a policy so that only people belonging to a certain AD group (which RADIUS will be pointed to) will be able to connect to VPN. (Configuring RADIUS Authentication with Client VPN) As far as 2FA is concerned, you can use RSA and DUO with the built-in Windows client, although it is limited to the Push or Biometric authentication methods as there is no way to input a code at this time. If you are using Meraki Cloud authentication, you can create multiple accounts for users to use with the VPN. (Managing User Accounts using Meraki Authentication)They do not have to have dashboard access in order to be setup as a VPN user. You should absolutely have individual accounts for each user accessing VPN.
... View more
02-26-2019
07:25 AM
3 Kudos
Glad to help out! I believe you are correct about the Auth Proxy checking the AD group membership, though I think that's based on what level of DUO you have. Your AD groups will sync with the DUO admin console You can keep RADIUS for the wifi and as a backup. We demo'd DUO and I really like the product. Ultimately we ended up going with RSA.
... View more
02-26-2019
05:16 AM
6 Kudos
Hey @DSchn , The DUO Access Gateway (DAG) and the Duo Authentication Proxy (DAP) are two different tools. The DAG acts as a kind of application portal for SSO. Users can log into the DAG and then click on company applications that you have protected using DUO. The DAG has 2FA enabled for login purposes. Additionally, you can have redirects happen on those websites you are protecting so that if someone were to navigate straight to the website without first going through the DAG, they would be redirected to the DAG for sign-in. The Authentication Proxy is what actually makes the 2FA happen. Instead of pointing your pointing to your VPN to the RADIUS server, you would instead point to the DAP. When a user attempts to connect to the VPN, they will hit the DAP which contacts AD to verify username and password. If that part is correct, they will then receive a PUSH notification to their DUO app. You will have to contact Meraki to adjust the time out on the back end for the push notification so that users don't experience a timeout. As of right now, the only way you can use 2FA with the Windows VPN Connection is with the PUSH notification or Biometrics as there is not place to put in an authentication code. This part is very frustrating. I wish support for Cisco AnyConnect would come soon!!
... View more
02-04-2019
08:50 AM
3 Kudos
Yes, they have to manually choose to connect to the VPN. As far as MX is concerned, we are using a MX600.
... View more
02-04-2019
08:04 AM
4 Kudos
We have about 375+ connections daily using the VPN with this setup. Most major issues come from issues with the various ISPs people use to be honest. As far as deployment to users, this is done via PowerShell script so we can easily push out updates as needed. We have users who travel often and have not experienced any issues at airports, hotels, cafe. If they were to experience the issue, they would just tether off their phones.
... View more
11-05-2018
12:44 PM
4 Kudos
@CarolineS, the current Z1, MX64W, MX65, and MX65W stencils show the back side of the devices (the side with the ports), but not the front of the device (the side with the status light). Conversely, the stencils for new MX models and Z3 only show the front side, but not the back. Could you please pass along that we would like to have both front and back of the security devices?
... View more
10-31-2018
07:53 AM
1 Kudo
We have people that are constantly travelling for work at my company (myself included). I don't think I've ever encountered an issue where I am unable to connect via VPN.
... View more
09-21-2018
05:50 AM
This large stock of APs, are they not already claimed in your organization when they've been ordered? If they had been claimed, they would be in your inventory and then you could search your inventory to find the device based on MAC. OR Are you ordering the APs and not adding the order to the dashboard thus not adding the APs to your Meraki inventory?
... View more
09-21-2018
04:43 AM
When ordering these devices, are the order numbers Meraki sends not being added to the dashboard? Once the order number is added in, you should be able to find the device via MAC.
... View more
09-20-2018
04:32 AM
Have you tried keeping it at DHCP and then giving it a fixed IP assignment from the DHCP page? Since doing that, we've had zero issues getting our devices to the IPs we want. Also, are you trying to set the static IP from the local admin page of the device or from the dashboard?
... View more
08-29-2018
01:55 PM
2 Kudos
Thanks for the shout out @CarolineS. If anything, the thanks should go to @NFL0NR and my boss for the idea to share the photos in the first place. It's been really fun taking pictures with @Maui_Meraki_Dog and all the Meraki swag, though I have to say my wife is the one responsible for the majority of the fashion shoots.
... View more
08-21-2018
10:17 AM
6 Kudos
@CarolineS, you've made this community a great place to be and be a part of. Thanks for your hard work and due diligence. To all the community members, thanks for all the posts, discussions, pictures, ideas, etc.
... View more
08-16-2018
07:17 AM
Hi @DennisSN, Unfortunately the org split and some static routing rules were my only options in this situation.
... View more
08-14-2018
04:48 AM
2 Kudos
Hi @Philip and welcome to the forums!! Meraki is without a doubt GUI over CLI. In fact, the closest thing you will get to CLI is working with APIs. Meraki is all about "Simplicity" and as you've seen that makes them easier than your typical Cisco router. Many people enjoy that....I personally wish there was a bit more CLI, but oh well. Thanks for the quick answer @AjitKumar!
... View more
08-01-2018
04:18 AM
4 Kudos
Agree with @BlakeRichardson! @RichG, those were an amazing find. We ordered a few and are doing a mockup for our travel team based on @ArpTableCorrupt's design. This is probably my favorite thread in awhile.
... View more
07-26-2018
12:46 PM
4 Kudos
Such a great idea. We're working on a mockup for our branches now. Great job!
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 466 | 02-28-2019 05:35 PM | |
| 248 | 02-26-2019 05:16 AM | |
| 1465 | 06-13-2018 02:12 PM | |
| 724 | 06-05-2018 08:52 AM | |
| 4979 | 11-15-2017 06:40 AM | |
| 1628 | 11-02-2017 10:50 AM | |
| 15658 | 10-25-2017 04:57 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 20 | 1733 | |
| 18 | 1108 | |
| 16 | 7568 | |
| 15 | 3048 | |
| 14 | 8928 |
